9 ms·

2005, https://github.com/pypi/legacy/commit/600f9383f8e7e0a2e608608781928b5d5780af77 https://github.com/pypi/legacy/commit/600f9383f8e7e0a2e60860...

• westurner 3y ago
  Well, I think there should be broader discussion of this inadequacy. "Implement "hook" support for package signature verification." (2013) https://github.com/pypi/warehouse/issues/1638#issuecomment-274521719 https://github.com/pypi/warehouse/issues/1638#issuecomment-2... "GPG signing - how does that really work with PyPI?" https://github.com/pypa/twine/issues/157#issuecomment-1014602391 https://github.com/pypa/twine/issues/157#issuecomment-101460... "Better integration with conda/conda-forge for building packages" https://github.com/pyodide/pyodide/issues/795#issuecomment-1250113736 https://github.com/pyodide/pyodide/issues/795#issuecomment-1... Conda now has their own package cryptographic signature software supply chain security control control. Unfortunately, conda's isn't yet W3D DIDs with Verifiable Credentials and sigstore either. Also, [CycloneDX] SBOMs don't have any package archive or package file signatures; so when you try to audit what software you have on all the containers on your infrastructure there's no way to check the cryptographic signatures of the package authors and maintainers against what's installed on disk. docker help sbom # check_signatures python conda zipapps apt/dnf/brew/chocolatey_nuget git /usr/local And without clients signing before uploading, we can only verify Data Integrity (1) at the package archive level; (2) with pypi's package signature key.